CN115665006A - Method and device for detecting following flow - Google Patents
Method and device for detecting following flow Download PDFInfo
- Publication number
- CN115665006A CN115665006A CN202211647573.4A CN202211647573A CN115665006A CN 115665006 A CN115665006 A CN 115665006A CN 202211647573 A CN202211647573 A CN 202211647573A CN 115665006 A CN115665006 A CN 115665006A
- Authority
- CN
- China
- Prior art keywords
- node
- flow
- detection
- data
- ifit
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
In the embodiment of the invention, iFIT encapsulation is carried out on a data message to be subjected to flow following detection, so that the data message carries iFIT encapsulation information, flow following detection analysis is carried out at a first node of the data message entering an iFIT domain by expanding the iFIT encapsulation information and returning flow following detection data, so that flow following detection can be realized under the condition of no analyzer, the problem of high deployment difficulty caused by low compatibility of repeaters or analyzers of different manufacturers is solved, and networking cost is reduced.
Description
Technical Field
The present application relates to the field of device detection, and in particular, to a method and an apparatus for detecting a stream.
Background
The Flow-following detection technology iFIT (in-situ Flow Information policy) can be applied to multiple standard networks such as MPLS (multi-protocol label switching), SR-MPLS (single-sequence Label switching), IPv6 and the like, and can detect performance parameters such as real-time packet loss rate, time delay and the like of the network based on data messages.
Currently, the ift requires the deployment of transponders and analyzers in conjunction to enable detection with the flow. The repeater mainly collects and reports data aiming at the service flow, and the data collection and the reporting comprise a timestamp and message statistics; the analyzer calculates and presents the detection information collected and reported by the repeater. However, often the repeaters and analyzers are not compatible due to different vendors, and deploying analyzers in the network also increases networking costs.
Disclosure of Invention
In view of this, the present application provides a flow detection method and apparatus, so as to achieve flow detection even without an analyzer.
Specifically, the method is realized through the following technical scheme:
the application provides a flow following detection method, which is characterized in that the method is applied to a node of an iFIT domain, the node is a first node of a data message accessed to the iFIT domain, and the method comprises the following steps:
carrying out iFIT packaging on a data message to be subjected to flow-following detection so that the data message carries iFIT packaging information; the iFIT encapsulation information at least comprises a service flow identifier FlowMonID and an H mark to which the data message belongs; the H mark is used for indicating other nodes receiving the data message to return the detection data with the flow to the head node;
after receiving the data message, other nodes in the iFIT domain detect data along with the flow, which is returned based on the data message;
and determining an follow-up stream detection result according to the received follow-up stream detection data.
Optionally, the H-tag is added to the ift encapsulation information by the head node based on head node analysis instructions.
Optionally, the H flag is carried in a reserved field that is idle after the delay detection flag in the ift encapsulation information.
Optionally, if the ift domain is an MPLS network, the ift encapsulation information further includes:
the IP address of the first node indicates other nodes receiving the data message to return the detection data with the flow to the first node based on the IP address; the IP address is carried below the service flow identifier FlowMonID in the iFIT encapsulation information.
Optionally, the stream following detection data at least includes: the FlowMonId, TTL, periodID, packetCount, timestamp and IP Address;
the TTL represents the TTL value of the service data flow and is used for identifying the precedence relationship when the head node receives the detection data returned by each node along with the flow; the period ID is used for identifying the detection period number; the PacketCount is the current cycle message statistics; the Timestamp is a Timestamp of the received data message; the IP Address is the IP Address of the return node.
Optionally, the determining an accompanied flow detection result according to the received accompanied flow detection data includes:
when the detection type is end-to-end flow following detection, determining an end-to-end flow following detection result according to flow following detection data of an inlet obtained by the head node and received flow following detection data sent from the tail node;
and when the detection type is node-by-node flow detection, determining a node-by-node flow detection result according to flow detection data of adjacent nodes in the data message transmission process.
The present application further provides a device for detecting along with a flow, where the device is applied to a node in an ift domain, where the node is a first node of the ift domain to which a data packet is accessed, and the device includes:
packaging the unit: the method comprises the steps that the data message to be detected along with the flow is subjected to iFIT encapsulation, so that the data message carries iFIT encapsulation information; the iFIT encapsulation information at least comprises a service flow identifier FlowMonID and an H mark to which the data message belongs; the H mark is used for indicating other nodes receiving the data message to return the detection data with the flow to the head node;
a receiving unit: the flow detection device is used for receiving the flow detection data returned by other nodes in the iFIT domain based on the data message after receiving the data message;
a determination unit: for determining an associated stream detection result in dependence on the received associated stream detection data.
Optionally, the H-tag is added to the ift encapsulation information by the head node based on head node analysis instructions.
Optionally, the H flag is carried in a reserved field that is idle after the delay detection flag in the ift encapsulation information.
Optionally, if the ift domain is an MPLS network, the ift encapsulation information of the encapsulation unit further includes:
the IP address of the first node indicates other nodes receiving the data message to return the detection data with the flow to the first node based on the IP address; the IP address is carried below the service flow identifier FlowMonID in the iFIT encapsulation information.
Optionally, the stream following detection data of the receiving unit and the determining unit at least includes: the FlowMonId, TTL, periodID, packetCount, timestamp and IP Address;
the TTL represents a TTL value of a service data stream and is used for identifying a precedence relationship when the head node receives the detection data returned by each node along with the stream; the period ID is used for identifying the detection period number; the PacketCount is the current period message statistics; the Timestamp is a Timestamp of the received data message; and the IP Address is the IP Address of the return node.
Optionally, the determining, by the determining unit, a result of the detected stream according to the received detected stream data includes:
when the detection type is end-to-end flow detection, determining an end-to-end flow detection result according to flow detection data of an inlet obtained by the head node and received flow detection data sent from the tail node;
and when the detection type is node-by-node flow detection, determining a node-by-node flow detection result according to flow detection data of adjacent nodes in the data message transmission process.
As can be seen from the above description, in the embodiment of the present application, by expanding the ift encapsulation information (also referred to as ift information) and implementing the flow-following detection analysis on the return of the flow-following detection data at the head node of the data packet entering the ift domain, the flow-following detection can be implemented without an analyzer, which solves the problem of difficulty in deployment due to low compatibility of transponders or analyzers of different manufacturers, and also reduces the networking cost.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and other drawings can be obtained by those skilled in the art according to the drawings.
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and together with the description, serve to explain the principles of the disclosure.
FIG. 1 is a block diagram of the deployment of an iFIT detection system in the prior art of the present application;
fig. 2 is a format diagram of the ift encapsulation information in the present application;
FIG. 3 is a flow chart of a method of an embodiment of the present application;
fig. 4 is a format diagram of the extended ift encapsulation information of the present application;
fig. 5 is a format diagram of another extended ift encapsulation information of the present application;
FIG. 6 is a format diagram of streaming check data according to the present application;
FIG. 7 is a block diagram of the deployment of the iFIT detection system of the present application;
fig. 8 is a diagram showing a structure of an apparatus according to an embodiment of the present application.
Detailed Description
Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. The following description refers to the accompanying drawings in which the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.
It will be understood that, although the terms first, second, third, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one type of device from another. For example, a first device may also be referred to as a second device, and similarly, a second device may also be referred to as a first device, without departing from the scope of the present application. The word "if," as used herein, may be interpreted as "at \8230; \8230when" or "when 8230; \823030when" or "in response to a determination," depending on the context.
In order to make the technical solutions provided in the embodiments of the present application better understood and make the above objects, features and advantages of the embodiments of the present application more comprehensible, the technical solutions in the embodiments of the present application are described in further detail below with reference to the accompanying drawings.
First, briefly introduce the following flow detection principle, as shown in fig. 1, specifically:
1. when a node in the ift domain, for example, node 1, receives a data packet, it is determined that node 1 is the first node of the ift domain. The node 1 identifies the service flow by matching the five-tuple, i.e., the source, source port, destination IP address, destination port, and transport layer protocol, and performs an ift encapsulation on the data packet of the service flow, where the specific format is shown in fig. 2. The key fields of the iFIT encapsulation information are: flowMonID is the data flow number; l is a dyeing mark, and is dyed by 0 or 1 in a cycle; d is a time delay detection mark, and the first packet 1 of each period is used for representing a time delay detection message. And a reserved field is arranged behind the detection delay mark and is used for expanding the iFIT encapsulation information.
The head node sends the data message containing the iFIT encapsulation information to other nodes in the iFIT domain, such as node 2, node 3 and the like, and enables the other nodes to acquire data of the service flow according to the data flow number FlowMonID.
2. Data acquisition is performed at each node of the ift field.
The first node directly performs data acquisition on the service flow identified by matching the quintuple.
And after receiving the data message containing the iFIT encapsulation information, other nodes determine the service flow to be collected through the FlowMonID in the iFIT encapsulation information, and perform periodic message statistics and timestamp recording on the service flow to obtain the detection data of the service flow on the node.
3. Each node takes FlowMonID as an object, encapsulates information such as reporting period ID, message statistics of the period, first packet timestamp of the period and the like into detection data along with the flow, reports the detection data to an analyzer and sends the detection data to the analyzer.
4. And the analyzer calculates the packet loss rate, the time delay and the jitter according to the detection data reported by each node and by taking the FlowMonId as an object, and displays the packet loss rate, the time delay and the jitter.
In the scheme, a node (transponder) mainly collects and reports data aiming at the service flow of an iFIT domain; the analyzer calculates and presents the detection information collected and reported by the node, and the two are not available. This leads to the following two problems:
1. often, transponders and analyzers are less compatible due to different vendors.
2. Analyzers are deployed in the network, resulting in increased networking costs.
In view of the above problems, embodiments of the present invention provide a method and an apparatus for detecting a flow following, in the method, expansion of the ift encapsulation information and return of flow following detection data are implemented to perform flow following detection analysis at a first node where a data packet enters an ift domain, which enables flow following detection to be implemented without an analyzer, and thus, the problem of difficulty in deployment due to low compatibility between transponders or analyzers of different manufacturers is solved, and networking cost is reduced.
Referring to fig. 3, which is a flowchart illustrating a flow following detection method according to an embodiment of the present invention, the method is applied to a node in an ift domain, where the node is a first node that accesses a data packet to the ift domain. The iFIT field is used for detecting performance indexes of the service flow, such as real packet loss rate, time delay and the like, along with the flow.
As shown in fig. 3, the process may include the following steps:
step S301, carrying out iFIT encapsulation on the data message to be detected along with the flow so that the data message carries iFIT encapsulation information.
In this embodiment, the first node of the ift field may identify the service flow by matching the quintuple, and determine the data packet in the service flow as the data packet to be detected along with the flow. After determining the data message to be detected with the flow, the first node performs an iFIT encapsulation on the data message, so that the data message carries iFIT encapsulation information. In this embodiment, the ift encapsulation information at least includes a service flow identifier FlowMonID to which the data packet belongs and an H flag, where the H flag is used to indicate that other nodes that receive the data packet return the flow following detection data to the first node.
In another embodiment, the H-tag is added to the ift encapsulation information by the head node based on head node analysis instructions determination.
In this embodiment, an analyzer may be deployed for the ift field, and a user instruction may be used to determine whether to start the calculation and analysis functions of the head node. When a user selects not to start the calculation and analysis functions of the first node, when the first node of the iFIT domain performs iFIT encapsulation on a data message to be subjected to flow following detection, no H mark is added in the iFIT encapsulation information, at the moment, each node returns flow following detection data to the analyzer, and the flow following detection data collected and reported by each node is calculated and presented through the analyzer. I.e. the flow-by detection method shown in fig. 1.
And when the head node receives the head node analysis instruction, determining to start the calculation and analysis functions of the head node, and adding an H mark in the iFIT encapsulation information by the head node at the moment so that other nodes of the iFIT field return detection data along with the flow to the head node.
In this embodiment, when the calculation and analysis functions of the head node need to be started, an H flag is added to the ift encapsulation information, and when the analysis calculation needs to be performed by the analyzer, the H flag is not added to the ift encapsulation information.
In another embodiment, the H flag is carried in a reserved field that is free after the delay detection flag in the ift encapsulation information.
In this embodiment, as shown in fig. 2, a specific format of the unfit encapsulation information without the H identifier is shown, in the unfit encapsulation information without the H identifier, a field D is a delay detection flag, and a plurality of reserved fields are left behind the field.
It should be noted that this embodiment only shows one implementation manner of adding the H identifier in the ift encapsulation information, and there are many implementation manners of specifically adding the H identifier, which is not limited in this application.
In another embodiment, if the ift field is an MPLS network, the ift encapsulation information further includes:
the IP address of the head node indicates other nodes receiving the data message to return the flow following detection data to the head node based on the IP address; the IP address is carried below the service flow identifier FlowMonID in the iFIT encapsulation information.
In this embodiment, a method for acquiring the IP address of the head node by other nodes may be determined according to the network of the ift domain. When the ift domain is in the MPLS network, the ift encapsulation information needs to be extended, and the IP address of the head node is added to the extended ift encapsulation information. The extended ift encapsulation information is shown in fig. 5. And after other nodes obtain the data message, the IP address of the head node is obtained through the iFIT encapsulation information which is carried in the data message and contains the IP address of the head node.
When the ift field is in the SRv6 network, the IP basic header of the SRv6 packet contains the IP address of the first node. Other nodes can acquire the IP address of the head node through the SRv6 message without adding the IP address of the head node into the iFIT encapsulation information.
S302, after receiving the data message, other nodes in the iFIT domain detect data based on the flow following returned by the data message.
In this embodiment, after obtaining the IP address of the head node, the other nodes may send the stream-following detection data to the head node as an ICMP message in a manner of extending an ICMP protocol.
In another embodiment, the streaming detection data at least includes: the FlowMonId, TTL, periodID, packetCount, timestamp and IP Address;
in this embodiment, the stream following detection data returned to the head node includes the following fields, as shown in fig. 6:
FlowMonId: and the data stream ID is used for identifying the data stream and obtaining the data stream from the stream-following detection indication information carried in the data stream.
TTL: and the TTL value of the service data flow is used for identifying the precedence relationship when the head node receives the detection data with the flow returned by each node.
PeriodID: the cycle ID is detected, identifying the data of the next cycle.
PacketCount: and counting the messages in the period.
TimestampSecon: timestamp seconds section, integer value.
TimestampNanoSecond: the nanosecond portion of the timestamp.
IP Address: the IP address of the node is returned.
Step S303, determining an associated stream detection result according to the received associated stream detection data.
In this embodiment, after the first node acquires the flow-following detection data returned by each node, the packet loss rate, the time delay, and the jitter of the service flow are calculated and presented according to the FlowMonId as an object. The specific calculation method of the first node is consistent with that of the analyzer, which is not described in detail herein.
In another embodiment, the determining the detection result with stream according to the received detection data with stream includes:
when the detection type is end-to-end flow following detection, determining an end-to-end flow following detection result according to flow following detection data of an inlet obtained by the head node and received flow following detection data sent from the tail node;
and when the detection type is node-by-node flow detection, determining a node-by-node flow detection result according to flow detection data of adjacent nodes in the data message transmission process.
In this embodiment, the non-loss data of the service flow may be determined through the entry flow following detection data of the head node, the data of the service flow passing through the ift domain may be determined through sending the flow following detection data by the tail node, and the performance indexes such as the real packet loss rate and the time delay of the data packet in the service flow may be obtained by comparing the two data. The method has the advantages of small calculation amount and capability of simply and conveniently calculating the performance indexes of the service flow such as the real packet loss rate, the time delay and the like when the service flow passes through the iFIT domain. However, the method does not analyze and calculate the detection data of the flow-following on each node, but only analyzes the first node and the tail node, so the method has the defect that the performance indexes of the real packet loss rate, the time delay and the like of the service flow on each node cannot be obtained.
For this reason, the present embodiment also provides another node-by-node flow detection method, that is, the flow detection data of any node is compared with the flow detection data of the adjacent node of the node. The adjacent nodes are the front nodes pointing to the node to send the data message and the back nodes pointing to the node to send the data message. As shown in fig. 1, the neighboring nodes of node 2 are node 1 and node 3. And determining the detection result of the service flow according to the detection result of each node. The method needs to increase the number of times of forwarding TTL of ICMP packets in the flow detection data, and the node adjacent relation is determined by the TTL. And if the TTL value of the current node is 5, the node with the TTL value of 4 is the front node of the current node, and the node with the TTL value of 6 is the back node of the current node.
The flow shown in fig. 3 is completed.
As can be seen from the flow shown in fig. 3, in the embodiment of the present invention, the flow-following detection analysis is performed at the first node where the data packet enters the ift domain by expanding the ift encapsulation information and returning the flow-following detection data, so that the flow-following detection can be performed without an analyzer, which solves the problem of difficulty in deployment due to low compatibility of transponders or analyzers of different manufacturers, and also reduces the networking cost.
The flow of fig. 3 is described below by way of a practical embodiment, as shown in fig. 7:
step 701, for a first node receiving a data packet in the ift domain, identifying a service flow by matching quintuple and other methods, and performing ift encapsulation on the data packet of the service flow, so that the data packet carries ift encapsulation information including an H identifier, thereby starting a first node calculation function.
In step 702, after the node of the ift domain receives the data packet carrying the ift encapsulation information including the H identifier, the FlowMonID in the ift encapsulation information is used as an object to perform periodic packet statistics and timestamp recording, and simultaneously, the TTL value of the service flow at the current node is recorded.
And 703, each node encapsulates the acquired detection data according to the format of fig. 6, and sends the detection information as ICMP data to the head node through ICMP standard protocol extension.
Step 704, after receiving the detection information of each node, the head node acquires the inlet flow following detection data of the head node and the flow following detection data of the tail node in the ift domain, calculates and presents the packet loss rate, the time delay and the jitter detection result of the data flow.
Or, determining the adjacent relation of each node through TTL in the detection information, taking the detection data of each adjacent node along with the flow, calculating and presenting the packet loss rate, the time delay and the jitter detection result of the data flow on each node.
In this embodiment, the analyzer is not deployed in the ift domain, but the flow detection data returned by other nodes is calculated and presented through the head node. The method simplifies the iIFT deployment mode, and can also carry out flow following detection under the condition of no analyzer so as to measure the performance indexes of the service flow, such as real packet loss rate, time delay and the like. The problem of low compatibility of repeaters or analyzers of different manufacturers is solved, and the cost required by deploying the analyzers is saved.
This completes the description of the method embodiment of the present invention.
The method provided by the embodiment of the present invention is described above, and the apparatus provided by the embodiment of the present invention is described below:
referring to fig. 8, the present application further provides a device for detecting a flow, where the device is applied to a node in an ift domain, where the node is a first node of a data packet accessing the ift domain, and the device includes:
the packaging unit 801: the method comprises the steps of performing iFIT encapsulation on a data message to be subjected to flow-following detection so that the data message carries iFIT encapsulation information; the iFIT encapsulation information at least comprises a service flow identifier FlowMonID and an H mark to which the data message belongs; the H mark is used for indicating other nodes receiving the data message to return the detection data with the flow to the head node;
the receiving unit 802: the flow detection device is used for receiving the flow detection data returned by other nodes in the iFIT domain based on the data message after receiving the data message;
the determination unit 803: for determining an associated stream detection result from the received associated stream detection data.
Optionally, the H-tag is added to the ift encapsulation information by the head node based on head node analysis instructions.
Optionally, the H flag is carried in a reserved field that is idle after the delay detection flag in the ift encapsulation information.
Optionally, if the ift domain is an MPLS network, the ift encapsulation information of the encapsulation unit further includes:
the IP address of the head node indicates other nodes receiving the data message to return the flow following detection data to the head node based on the IP address; the IP address is carried below the service flow identifier FlowMonID in the iFIT encapsulation information.
Optionally, the stream following detection data of the receiving unit 802 and the determining unit 803 at least include: the FlowMonId, TTL, periodID, packetCount, timestamp and IP Address;
the TTL represents the TTL value of the service data flow and is used for identifying the precedence relationship when the head node receives the detection data returned by each node along with the flow; the PeriodID is a detection period ID and is used for identifying the number of detection periods; the PacketCount is the current period message statistics; the Timestamp is a Timestamp of the received data message; and the IP Address is the IP Address of the return node.
Optionally, the determining unit 803 determines, according to the received associated stream detection data, that an associated stream detection result includes:
when the detection type is end-to-end flow detection, determining an end-to-end flow detection result according to flow detection data of an inlet obtained by the head node and received flow detection data sent from the tail node;
and when the detection type is node-by-node flow detection, determining a node-by-node flow detection result according to flow detection data of adjacent nodes in the data message transmission process.
From the above description of the embodiments, it is clear to those skilled in the art that the present application can be implemented by software plus necessary general hardware platform. Based on such understanding, the technical solutions of the present application or portions thereof that contribute to the prior art may be embodied in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, or the like, and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute the method according to the embodiments or some portions of the embodiments of the present application.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for apparatus or system embodiments, since they are substantially similar to method embodiments, they are described in relative terms, as long as they are described in partial descriptions of method embodiments. The above-described apparatus or system embodiments are merely illustrative, wherein the modules described as separate components may or may not be physically separate, and the functions of the modules may be implemented in one or more of software and/or hardware when implementing the aspects of the present application. And part or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of the embodiment. One of ordinary skill in the art can understand and implement it without inventive effort.
The foregoing is directed to embodiments of the present application and it is noted that numerous modifications and adaptations may be made by those skilled in the art without departing from the principles of the present application and are intended to be within the scope of the present application.
Claims (12)
1. A detection method along with flow is characterized in that the method is applied to a node of an iFIT domain, the node is a first node of a data message accessed to the iFIT domain, and the method comprises the following steps:
carrying out iFIT packaging on a data message to be subjected to flow-following detection so that the data message carries iFIT packaging information; the iFIT encapsulation information at least comprises a service flow identifier FlowMonID and an H mark to which the data message belongs; the H mark is used for indicating other nodes receiving the data message to return the detection data with the flow to the head node;
after receiving the data message, other nodes in the iFIT domain detect data along with the flow, which is returned based on the data message;
and determining an associated stream detection result according to the received associated stream detection data.
2. The method of claim 1, wherein the H-tag is added to the ift encapsulation information by the head node based on head node analysis instructions determination.
3. The method of claim 1, wherein the H-tag is carried in a reserved field that is free after a delay detection tag in the ift encapsulation information.
4. The method according to claim 1, wherein if the ift domain is an MPLS network, the ift encapsulation information further comprises:
the IP address of the head node indicates other nodes receiving the data message to return the flow following detection data to the head node based on the IP address; the IP address is carried below the service flow identifier FlowMonID in the iFIT encapsulation information.
5. The method of claim 1, wherein the detecting data with the flow comprises at least: the FlowMonId, TTL, periodID, packetCount, timestamp and IP Address;
the TTL represents the TTL value of the service data flow and is used for identifying the precedence relationship when the head node receives the detection data returned by each node along with the flow; the period ID is used for identifying the detection period number; the PacketCount is the current period message statistics; the Timestamp is a Timestamp of the received data message; and the IP Address is the IP Address of the return node.
6. The method of claim 1, wherein determining the detection result from the received detection data comprises:
when the detection type is end-to-end flow detection, determining an end-to-end flow detection result according to flow detection data of an inlet obtained by the head node and received flow detection data sent from the tail node;
and when the detection type is node-by-node flow detection, determining a node-by-node flow detection result according to flow detection data of adjacent nodes in the data message transmission process.
7. The device for detecting the flow following is applied to a node of an iFIT domain, wherein the node is a first node of a data packet accessed to the iFIT domain, and the device comprises:
packaging the unit: the method comprises the steps that the data message to be detected along with the flow is subjected to iFIT encapsulation, so that the data message carries iFIT encapsulation information; the iFIT encapsulation information at least comprises a service flow identifier FlowMonID and an H mark to which the data message belongs; the H mark is used for indicating other nodes receiving the data message to return the detection data with the flow to the head node;
a receiving unit: the flow detection device is used for receiving the flow detection data returned by other nodes in the iFIT domain based on the data message after receiving the data message;
a determination unit: for determining an associated stream detection result from the received associated stream detection data.
8. The apparatus of claim 7, wherein the H-tag is added to the ift encapsulation information by the head node based on head node analysis instructions determination.
9. The apparatus of claim 7, wherein the H-tag is carried in a reserved field that is free after a delay detection tag in the ift encapsulation information.
10. The apparatus of claim 7, wherein if the ift field is an MPLS network, the ift encapsulation information of the encapsulation unit further comprises:
the IP address of the first node indicates other nodes receiving the data message to return the detection data with the flow to the first node based on the IP address; the IP address is carried below the service flow identifier FlowMonID in the iFIT encapsulation information.
11. The apparatus of claim 7, wherein the stream detection data of the receiving unit and the determining unit at least comprises: the FlowMonId, TTL, periodID, packetCount, timestamp and IP Address;
the TTL represents the TTL value of the service data flow and is used for identifying the precedence relationship when the head node receives the detection data returned by each node along with the flow; the PeriodID is a detection period ID and is used for identifying the number of detection periods; the PacketCount is the current period message statistics; the Timestamp is a Timestamp of the received data message; and the IP Address is the IP Address of the return node.
12. The apparatus of claim 7, wherein the determining unit determines the detection result according to the received detection data comprises:
when the detection type is end-to-end flow detection, determining an end-to-end flow detection result according to flow detection data of an inlet obtained by the head node and received flow detection data sent from the tail node;
and when the detection type is the node-by-node flow detection, determining a node-by-node flow detection result according to the flow detection data of the adjacent nodes passing through in the data message transmission process.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211647573.4A CN115665006B (en) | 2022-12-21 | 2022-12-21 | Follow-up flow detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211647573.4A CN115665006B (en) | 2022-12-21 | 2022-12-21 | Follow-up flow detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115665006A true CN115665006A (en) | 2023-01-31 |
| CN115665006B CN115665006B (en) | 2023-03-28 |
Family
ID=85022554
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211647573.4A Active CN115665006B (en) | 2022-12-21 | 2022-12-21 | Follow-up flow detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115665006B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116668343A (en) * | 2023-07-31 | 2023-08-29 | 新华三技术有限公司 | Stream following detection method, device, equipment and storage medium |
Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101030940A (en) * | 2007-04-09 | 2007-09-05 | 华为技术有限公司 | Method for equilibrating network-flow load and the third-level exchanger |
| CN101447900A (en) * | 2008-12-15 | 2009-06-03 | 华为技术有限公司 | Method, system and device for building bidirectional forwarding detection |
| CN103369594A (en) * | 2012-04-06 | 2013-10-23 | 华为技术有限公司 | Method, device and system for marking service data packet |
| US20160036837A1 (en) * | 2014-08-04 | 2016-02-04 | Microsoft Corporation | Detecting attacks on data centers |
| US20210092153A1 (en) * | 2018-02-05 | 2021-03-25 | Chongqing University Of Posts And Telecommunications | Ddos attack detection and mitigation method for industrial sdn network |
| CN113079091A (en) * | 2020-01-03 | 2021-07-06 | 华为技术有限公司 | Active stream following detection method, network equipment and communication system |
| CN113098749A (en) * | 2020-01-08 | 2021-07-09 | 华为技术有限公司 | Message sending method, device and storage medium |
| CN113328902A (en) * | 2020-02-29 | 2021-08-31 | 华为技术有限公司 | Network performance detection method and device and network equipment |
| CN113382437A (en) * | 2020-03-10 | 2021-09-10 | 华为技术有限公司 | Follow-up flow detection method and device |
| CN113810295A (en) * | 2021-08-05 | 2021-12-17 | 新华三大数据技术有限公司 | Path detection method, device and system |
| CN114430386A (en) * | 2020-10-14 | 2022-05-03 | 华为技术有限公司 | Method and related device for detecting multicast service flow |
| CN114511268A (en) * | 2022-02-14 | 2022-05-17 | 河北重优科技有限公司 | Detection interaction method for packaging of Internet of things |
| CN114553746A (en) * | 2019-05-16 | 2022-05-27 | 华为技术有限公司 | Message detection method, device and system |
| CN115280745A (en) * | 2021-03-25 | 2022-11-01 | 新华三技术有限公司 | Follow-up flow detection method and electronic equipment |
-
2022
- 2022-12-21 CN CN202211647573.4A patent/CN115665006B/en active Active
Patent Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101030940A (en) * | 2007-04-09 | 2007-09-05 | 华为技术有限公司 | Method for equilibrating network-flow load and the third-level exchanger |
| CN101447900A (en) * | 2008-12-15 | 2009-06-03 | 华为技术有限公司 | Method, system and device for building bidirectional forwarding detection |
| CN103369594A (en) * | 2012-04-06 | 2013-10-23 | 华为技术有限公司 | Method, device and system for marking service data packet |
| US20160036837A1 (en) * | 2014-08-04 | 2016-02-04 | Microsoft Corporation | Detecting attacks on data centers |
| US20210092153A1 (en) * | 2018-02-05 | 2021-03-25 | Chongqing University Of Posts And Telecommunications | Ddos attack detection and mitigation method for industrial sdn network |
| CN114553746A (en) * | 2019-05-16 | 2022-05-27 | 华为技术有限公司 | Message detection method, device and system |
| CN113079091A (en) * | 2020-01-03 | 2021-07-06 | 华为技术有限公司 | Active stream following detection method, network equipment and communication system |
| CN113098749A (en) * | 2020-01-08 | 2021-07-09 | 华为技术有限公司 | Message sending method, device and storage medium |
| CN113328902A (en) * | 2020-02-29 | 2021-08-31 | 华为技术有限公司 | Network performance detection method and device and network equipment |
| CN113382437A (en) * | 2020-03-10 | 2021-09-10 | 华为技术有限公司 | Follow-up flow detection method and device |
| CN114430386A (en) * | 2020-10-14 | 2022-05-03 | 华为技术有限公司 | Method and related device for detecting multicast service flow |
| CN115280745A (en) * | 2021-03-25 | 2022-11-01 | 新华三技术有限公司 | Follow-up flow detection method and electronic equipment |
| CN113810295A (en) * | 2021-08-05 | 2021-12-17 | 新华三大数据技术有限公司 | Path detection method, device and system |
| CN114511268A (en) * | 2022-02-14 | 2022-05-17 | 河北重优科技有限公司 | Detection interaction method for packaging of Internet of things |
Non-Patent Citations (2)
| Title |
|---|
| 左志斌;常朝稳;祝现威;: "一种基于数据平面可编程的软件定义网络报文转发验证机制" * |
| 邓晓衡,陈志刚,张连明,陈章: "一种基于TCP的简单实时端到端带宽测量技术" * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116668343A (en) * | 2023-07-31 | 2023-08-29 | 新华三技术有限公司 | Stream following detection method, device, equipment and storage medium |
| CN116668343B (en) * | 2023-07-31 | 2023-10-31 | 新华三技术有限公司 | Stream following detection method, device, equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115665006B (en) | 2023-03-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11863435B2 (en) | Segment routing network signaling and packet processing | |
| US20220086073A1 (en) | Data packet detection method, device, and system | |
| US9306819B2 (en) | Controller driven OAM for split architecture network | |
| US9065767B2 (en) | System and method for reducing netflow traffic in a network environment | |
| US20070064611A1 (en) | Method for monitoring packet loss ratio | |
| US20060215577A1 (en) | System and methods for identifying network path performance | |
| Vanaubel et al. | Network fingerprinting: TTL-based router signatures | |
| US20060067240A1 (en) | Apparatus and method for detecting network traffic abnormality | |
| US20090052332A1 (en) | Device, system, method and program for collecting network fault information | |
| KR20040052015A (en) | Traffic measurement system and traffic analysis method thereof | |
| CN112804075B (en) | Method, device and system for sending message and receiving message for OAM (operation administration and maintenance) | |
| US8593974B2 (en) | Communication conditions determination method, communication conditions determination system, and determination apparatus | |
| CN110166311B (en) | Method, equipment and network system for measuring network performance | |
| CN114584485B (en) | Method, apparatus, device and computer readable storage medium for detecting edge network quality | |
| CN115665006B (en) | Follow-up flow detection method and device | |
| CN112291093A (en) | Network detection method, device, network equipment and network system | |
| US20130051252A1 (en) | Methods, systems, and computer program products for monitoring network performance | |
| US7715317B2 (en) | Flow generation method for internet traffic measurement | |
| CN110677327A (en) | Chip-based real-time detection method for RTP flow fault | |
| CN113810295A (en) | Path detection method, device and system | |
| CN112350844B (en) | Method and device for data transmission | |
| CN114745302B (en) | Communication method and device | |
| JP2004032377A (en) | Method and system for estimating bottle neck and computer readable recording medium recorded with program of that method | |
| CN116806035A (en) | Time delay analysis method and device | |
| CN114039888A (en) | Time delay measuring method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |